Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
02-08-2024 03:46
General
-
Target
82ebfa8c96baa06ca6ad0a186e913778_JaffaCakes118.exe
-
Size
403KB
-
MD5
82ebfa8c96baa06ca6ad0a186e913778
-
SHA1
ded18871dc63c82f4c78a2a8864ec339a80b3d3c
-
SHA256
1cac59167c2e99fd929501153834df1cfd1463ff9930cc04f33f1c1041f8672a
-
SHA512
c528408e67bde88dfc72e779a07ced1e2608075443e4228bedcba218bdd63b79d3c29733a125cf185a21a370fcfe55053548b288b2ecce9ab4df97054b11ef7c
-
SSDEEP
6144:0Lf6yK4bOhYCo0b5CvEta++7tNeepwP7LpZU1u4vrBvnqJN2W:0Dhhb85U+a+wT4LfU1u4vN8N
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 3 IoCs
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\82ebfa8c96baa06ca6ad0a186e913778_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82ebfa8c96baa06ca6ad0a186e913778_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\nHg24500kIlPh24500\nHg24500kIlPh24500.exe"C:\ProgramData\nHg24500kIlPh24500\nHg24500kIlPh24500.exe" BOMBARDAMAXIMUM2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\nHg24500kIlPh24500\nHg24500kIlPh24500.exe"C:\ProgramData\nHg24500kIlPh24500\nHg24500kIlPh24500.exe" "C:\Users\Admin\AppData\Local\Temp\82ebfa8c96baa06ca6ad0a186e913778_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD52565e1273e75885f631f63231681a710
SHA177266f343d1b88e0f91f4d7607a043980cb5944e
SHA25675ba59c1aaf91f1e5bbd14a547c9c741569397b41c0d4f1ee173effc45b7acc9
SHA512e3de91ed4bcbe7064ddaf050f2dd7a38a3d59879ba80224ca9ab412f91bbd2737821f68c6ecdbabec10a373060792eaa4dc629eea84d90b3446e6617509b1286
-
Filesize
192B
MD5a5f2dda428196f38ff248858db30b911
SHA175c23a0896867bd338094a4a51a9f1c4f0a9d71f
SHA256f33ed0c64b949d435182c957ab89f74fe4a73121ed70bdb44280ee6058e8c6cc
SHA5128d3b680ae20c2f3c184d545786edece3fcf68ff80ac173173ef74ef0f2e7623120ee54ce8abf58c40a933a894e2b19b666daec3eadee4f97b482020d97093cde
-
Filesize
403KB
MD582ebfa8c96baa06ca6ad0a186e913778
SHA1ded18871dc63c82f4c78a2a8864ec339a80b3d3c
SHA2561cac59167c2e99fd929501153834df1cfd1463ff9930cc04f33f1c1041f8672a
SHA512c528408e67bde88dfc72e779a07ced1e2608075443e4228bedcba218bdd63b79d3c29733a125cf185a21a370fcfe55053548b288b2ecce9ab4df97054b11ef7c
-
Filesize
920KB
-
Filesize
920KB
-
Filesize
920KB
-
Filesize
4KB
-
Filesize
920KB
-
Filesize
920KB
-
Filesize
920KB
-
Filesize
920KB
-
Filesize
920KB
-
Filesize
920KB
-
Filesize
920KB